I have a setup where I have installed a local NetBrain server on a virtual machine in a customer environment. It communicates with my NetBrain server in my local data center, and I can discover and map devices on the customer network.

The problem is this: when I tune devices using Shared Network Settings, the devices are discovered, respond to pings, and the Telnet/SSH, Login and Enable tests are all successful and return "Succeeded" in their columns in the table.

However, when I try to access the devices in the map window via right-click, select Telnet/SSH CLI Access - it cannot connect. I get the error "> Connection failed:[10060] Connection timed out"

Why can I tune them and connect, but can't connect to the CLI on those devices?

I'd wager to say the SSH tuning test was done from the server on the customer premises, while your attempt to SSH to the device in the Workspace was done from your location. I think only the NetBrain ports need to be open for the discovery to fully succeed.
One of the forum admins should be able to confirm or deny that hypothesis.

CBrey is 1005 correct. When you initiate "telnet" to a device manually, that is sourced from you PC where the client is running, whereas tuning initiates the sessions from the network server of Netbrain.

If you want to be able to telnet the device directly, make sure your laptop/client IP is allowed to access the devices on the VTY lines. Therefore, check routing from you client source and then the ACL on VTY lines.

I have a setup where I have installed a local NetBrain server on a virtual machine in a customer environment. It communicates with my NetBrain server in my local data center, and I can discover and map devices on the customer network.

The problem is this: when I tune devices using Shared Network Settings, the devices are discovered, respond to pings, and the Telnet/SSH, Login and Enable tests are all successful and return "Succeeded" in their columns in the table.

However, when I try to access the devices in the map window via right-click, select Telnet/SSH CLI Access - it cannot connect. I get the error "> Connection failed:[10060] Connection timed out"

Why can I tune them and connect, but can't connect to the CLI on those devices?

1. You need to make sure that the PC/Laptop which is the EE workstation installed has access to the target device.
You can use putty to access target device from your PC/Laptop to verify that.

2. You need to make sure that Local Network Settings has been configured, and that local tune is successful.
You can refer to below link to set up your Local Network Setting.
https://www.netbraintech.com/ftp/EE62/OnlineHelp/index.html?local_network_setting.htm